Medium
CVE-2026-21451
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 3,406
Reset filters
High
CVE-2026-21446
Bagisto Missing Authentication on Installer API Endpoints
Medium
CVE-2025-69277
libsodium has Incomplete List of Disallowed Inputs
High
CVE-2025-69210
FacturaScripts is Vulnerable to Stored Cross-Site Scripting (XSS) via XML File Upload
High
ghsa-6mp4-q625-mxjp
YOURLS is vulnerable to XSS through JSONP and Callback request parameters
Low
CVE-2025-67746
Composer is vulnerable to ANSI sequence injection
High
CVE-2025-69200
phpMyFAQ has unauthenticated config backup download via /api/setup/backup
Low
ghsa-mgr9-6c2j-jxrq
Pterodactyl has a Reflected XSS vulnerability in “Create New Database Host”
Medium
CVE-2025-68951
phpMyFAQ has Stored XSS in user list via admin-managed display_name
Medium
CVE-2025-68614
LibreNMS Alert Rule API Cross-Site Scripting Vulnerability
High
CVE-2023-53957
Kimai contains a SameSite cookie vulnerability
Medium
CVE-2025-14761
AWS SDK for PHP's S3 Encryption Client has a Key Commitment Issue
Medium
CVE-2023-53929
phpMyFAQ contains a CSV injection vulnerability
Unrated
CVE-2025-14840
drupal/http_client_manager - SA-CONTRIB-2025-126
High
CVE-2024-58303
FoF Pretty Mail has a server-side template injection vulnerability
Low
CVE-2025-67737
AzuraCast Vulnerable to Pre-Auth File Deletion & Admin RCE
High
CVE-2025-67648
Shopware Storefront Reflected XSS in Storefront Login Page
Critical
CVE-2025-67510
Neuron MySQLWriteTool allows arbitrary/destructive SQL when exposed to untrusted prompts (agent “footgun”)
High
CVE-2025-67509
Neuron MySQLSelectTool “read-only” bypass via `SELECT ... INTO OUTFILE` (file write → potential RCE)
High
CVE-2025-67507
Filament multi-factor authentication (app) recovery codes can be used multiple times
Medium
CVE-2025-66578
robrichards/xmlseclibs has an Libxml2 Canonicalization error which can bypass Digest/Signature validation
High
CVE-2025-65346
alexusmai laravel-file-manager is vulnerable to Directory Traversal via the unzip/extraction functionality
Low
CVE-2025-65345
alexusmai laravel-file-manager is vulnerable to Directory Traversal
Unrated
CVE-2025-13983
drupal/tagify - SA-CONTRIB-2025-121
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.